CISA adds three exploited bugs, including an OpenSSH password bypass

CISA added three vulnerabilities to its known-exploited catalog on November 9, 2026. The catalog lists a due date of November 12, 2026 for each one. It does not give a clock time. The three entries are CVE-2026-123158 in OpenSSH, CVE-2026-116779 in FreeSWITCH, and CVE-2026-102895 in GPUStack. NVD has not posted a score for any of the three.

The OpenSSH bug can bypass password checks on some Linux systems. CISA names it an unexpected status-code flaw that could allow an authentication bypass. NVD says sshd in OpenSSH before 10.6p2, on Linux with musl libc and without PAM, can treat some strings as if they were not password hashes. For some account setups, NVD says any password between 256 and 1024 characters succeeds. It names Alpine Linux as an example of that setup. CISA points to the OpenSSH release notes and an Alpine post. It marks ransomware use as unknown.

The FreeSWITCH bug can run commands after a crafted chat message. CISA says CVE-2026-116779 can disclose configuration and credentials, control calls, and run commands. NVD says versions before 1.11.3 split part of an inbound SIP message and could reach an API that runs operating-system commands with the daemon's privileges. It says inbound chat is on in the stock internal and external profiles, and that an authenticated account is enough. NVD says exploitation has been observed in the wild. The fix is version 1.11.3.

The GPUStack bug can grant administrator access without a login. CISA says CVE-2026-102895 could allow unauthenticated administrative access, including user and model changes, a lasting administrator key, disclosure of worker and cloud-provider secrets, and code execution through one upload path. NVD says versions before 2.2.0 treated some loopback-looking requests as the built-in administrator when a local-auth setting was off, which was the default. It says exploitation was observed against a 2.1.1 deployment. The fix is version 2.2.0.

CISA marks ransomware use as unknown for all three. It says forensic triage is required under BOD 26-04. The required action is the same: apply the vendor's mitigations, follow that directive, and stop using the product if no mitigation is available. The catalog does not name a victim count or a dollar loss.